On Christmas Day 2025, many Viber users who sent holiday greetings to one another were surprised to see a Jollibee advertisement within their chats. It sparked concerns over a possible data privacy violation.
The National Privacy Commission (NPC), the Philippines’ data privacy watchdog, has cleared Jollibee Foods Corp. and messaging platform Viber of alleged data privacy violations tied to a viral holiday marketing campaign. It concluded that no personal data was processed and no unauthorized access to user communications occurred.
In a press statement, the NPC said its Complaints and Investigation Division (NPC-CID) found that the “Holiday Gems Christmas Campaign 2025” did not involve the processing of personal information as defined under the Data Privacy Act of 2012 or Republic Act No. 10173. It also “did not find evidence of unlawful access to user communications,” following months of scrutiny.
The ruling comes after public backlash in December last year, when users reported seeing branded greetings, animations and stickers appearing within private Viber chats.
The NPC launched a probe in January after receiving complaints and media reports describing the campaign as “intrusive,” with some users questioning whether their messages were being scanned or monitored.
At the time, regulators sought explanations from both Jollibee and Viber to determine if the campaign involved personal data processing and whether it complied with privacy principles such as transparency, legitimate purpose and proportionality.
However, the NPC said the campaign relied on a different mechanism altogether. According to the commission, the system used “contextual, on-device matching” based on predefined keywords stored locally within the app.
This meant that any triggering of holiday-themed visuals happened directly on the user’s device, without message content being transmitted to external servers for analysis.
The NPC-CID also found that campaign delivery was based on country-level parameters rather than precise location tracking or individual profiling, further weakening claims that personal data had been processed.
The commission reminded the public to remain vigilant and report suspicious activities, emphasizing that investigations will continue to ensure that innovation in digital marketing does not come at the expense of privacy rights.
